Hitachi Energy's RTU500 series Missing synchronization (CVE-2025-1445)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503159);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/04/14");

  script_cve_id("CVE-2025-1445");
  script_xref(name:"ICSA", value:"25-093-01");

  script_name(english:"Hitachi Energy's RTU500 series Missing synchronization (CVE-2025-1445)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");

  script_set_attribute(attribute:"description", value:
"A vulnerability exists in RTU IEC 61850 client and
server functionality that could impact the availability if
renegotiation of an open IEC61850 TLS connection
takes place in specific timing situations, when
IEC61850 communication is active.
Precondition is that IEC61850 as client or server are
configured using TLS on RTU500 device. It affects the
CMU the IEC61850 stack is configured on.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
# https://publisher.hitachienergy.com/preview?DocumentID=8DBD000207&LanguageCode=en&DocumentPartId=&Action=Launch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5910065f");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-01");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Hitachi Energy has identified the following specific workarounds and mitigations users can apply to reduce risk:

- For all versions, apply general mitigation factors/workarounds. Upgrade the system once remediated version is available, or apply general mitigation factors.
- RTU500 series CMU 12.0.1 - 12.0.14, 12.2.1 - 12.2.12, 12.4.1 - 12.4.11, 12.6.1 - 12.6.10, 12.7.1 - 12.7.7: Update to version 12.7.8 when available.
- RTU500 series CMU version 13.2.1 - 13.2.7, 13.4.1 - 13.4.4, 13.5.1 - 13.5.3, 13.6.1: Update to version 13.7.1
- RTU500 series CMU 13.5.1 - 13.5.3: Update to version 13.5.4 when available.
- RTU500 series CMU 13.6.1: Update to version 13.6.2 when available.
- (CVE-2024-11499, CVE-2025-1445) RTU500 series CMU 13.7.1 - 13.7.4: Update to version 13.7.6 when available.
- (CVE-2024-12169) RTU500 series CMU 13.4.1 - 13.4.4, 13.5.1 - 13.5.3, 13.6.1, 13.7.1 - 13.7.4: Update to version 13.7.6 when available.

For more information see the associated Hitachi Energy PSIRT security advisory 8DBD000207.

Hitachi Energy recommends users implement recommended security practices and firewall configurations to help
protect the process control network from attacks originating from outside the network. Process control systems
should be physically protected from direct access by unauthorized personnel, have no direct connections to the
Internet, and be separated from other networks by means of a firewall system with a minimal number of ports
exposed. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.
Portable computers and removable storage media should be carefully scanned for viruses before they are connected
to a control system.

For more information, see Hitachi Energy's Security Advisories.");

  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:H/SC:N/SI:N/SA:H");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/R:A");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-1445");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(820);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/03/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/04/14");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu500_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/ABB");

  exit(0);
}

include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/ABB');

var asset = tenable_ot::assets::get(vendor:'ABB');

var vuln_cpes = {
    "cpe:/o:hitachienergy:rtu500_firmware" :
        {"versionEndIncluding" : "13.7.4", "versionStartIncluding" : "13.7.1", "family" : "AbbRTU500"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);